Dismissal of Class Lawsuit againts Sony for the 2011 PSN Hack by JNieves86


More Info
									              !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111      ooofff      333666

10                                                                                              UNITED STATES DISTRICT COURT
11                                                                                       SOUTHERN DISTRICT OF CALIFORNIA
     In re:                                )                                                                                                                   MDL No.11md2258 AJB (MDD)
13                                         )
                  SONY GAMING NETWORKS AND )                                                                                                                   Civil Case Nos. 11cv2119, 11cv2120
14                CUSTOMER DATA SECURITY   )
                  BREACH LITIGATION        )                                                                                                                   ORDER GRANTING IN PART AND
15                                         )                                                                                                                   DENYING IN PART DEFENDANTS’
                                           )                                                                                                                   MOTION TO DISMISS PLAINTIFFS’
16                                         )                                                                                                                   CONSOLIDATED CLASS ACTION
                                           )                                                                                                                   COMPLAINT
17                                         )
                                           )                                                                                                                   [Doc. No. 94]
18                                         )
19                Presently before the Court are (1) Defendants’ Motion to Dismiss Plaintiffs’ Consolidated Class
20   Action Complaint; and (2) Defendants’ Supplemental Request for Judicial Notice. [Doc. 94.] Plaintiffs
21   filed an opposition, [Doc. No. 107], and Defendants filed a reply, [Doc. No. 114]. The Court held a
22   hearing on the motion on Thursday, September 27, 2012.1 For the reasons set forth below, the Court (1)
23   GRANTS in part and DENIES in part Defendants’ motion to dismiss Plaintiffs’ Consolidated Class
24   Action Complaint; and (2) GRANTS in part and DENIES in part Defendants’ Supplemental Request
25   for Judicial Notice.
27                1
               Timothy Blood, Brian Strange, and Gayle Blatt appeared in person on behalf of the Plaintiffs,
     and Paul Geller, Adam Levitt, Ben Barrow, and David McKay appeared telephonically on behalf of the
28   Plaintiffs. William Boggs, Amanda Fitzsimmons, Harvey Wolkoff, Dan Routh, and Mark Szpak
     appeared on behalf of the Defendants.

                                                                                                                                                             1                                                                                                                              11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222      ooofff      333666

 1                                                                                                                               BACKGROUND
 2   I.        Factual Background
 3             This action arises out of a criminal intrusion into the computer network system used to provide
 4   PlayStation Network (“PSN”) services. Plaintiffs, a putative consumer class, allege that Sony Computer
 5   Entertainment America, LLC (“SCEA”), Sony Network Entertainment International, LLC and Sony
 6   Network Entertainment America, Inc. (collectively, “SNE”), Sony Online Entertainment, LLC (“SOE”),
 7   and Sony Corporation of America (“SCA”) (collectively, “Sony” or “Defendants”) failed to follow basic
 8   industry-standard protocols to safeguard its customers personal and financial information, thereby
 9   creating foreseeable harm and injury to the Plaintiff class.
10             Sony develops and markets the PlayStation Portable (“PSP”) hand-held device and the
11   PlayStation 3 (“PSP”) console (collectively, “consoles”).2 [Compl. ¶¶ 24, 25.] Among their key
12   features are their ability to let users play games, connect to the Internet, access the PlayStation Network
13   (“PSN”), Qriocity, and Sony Online Entertainment (“SOE”) (collectively, “Sony Online Services” or
14   “SOS”), [Id. ¶¶ 26, 27-29]. For additional fees, the PSN also allows access to various third party
15   services such as Netflix, MLB.TV, and NHL Gamecenter LIVE (“Third Party Services”). [Id. ¶ 31.]
16   These additional fees are paid to the source of the service rather than to Sony. Many who subscribe to
17   these Third Party Services can only access them through their PSN account. [Id. ¶¶ 9-11, 14, 38.] As of
18   January 25, 2011, PSN had over 69 million users worldwide,[Id], and SOE had over 24.6 million users
19   worldwide, [Id. ¶ 29].
20             When establishing accounts with PSN, Qriocity, and SOE, Plaintiffs and other Class members
21   were required to provide personally identifying information to Sony, including their names, mailing
22   addresses, email addresses, birth dates, credit and debit card information (card numbers, expiration dates
23   and security codes) and login credentials (“Personal Information”), which Sony stores and maintains on
28             2
              As it must, for purposes of the present Motion to Dismiss, the Court accepts as true the factual
     allegations set forth by Plaintiffs in the Consolidated Complaint.

                                                                                                                                                          2                                                                                                                              11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333      ooofff      333666

 1   its Network. [Id. at 35.] Sony continually monitors and records users’ PSN activities, purchases and
 2   usage, and maintains this usage data on its Network.3 [Id. ¶ 36.]
 3             Plaintiffs allege that on April 16 or 17, 2011, hackers accessed Sony’s Network, stealing the
 4   Personal Information of millions of Sony customers, including Plaintiffs and the other Class members
 5   (the “Data Breach”). [Id. ¶ 46.] On April 17, 2011, Sony discovered that PSN and Qriocity user data
 6   had been stolen. [Id. ¶ 51.] Three days later, Sony took the PSN and Qriocity offline, stating that
 7   “[w]e’re aware certain functions of PlayStation Network are down. We will report back here as soon as
 8   we can with more information.” [Id. ¶ 52.] As a result of the Data Breach, Sony was forced to shut
 9   down the PSN and Qriocity for almost a month while it conducted a systems audit to determine the
10   cause of the data breach. [Id. ¶ 97.] Meanwhile, SOE remained offline for more than two weeks.
11   During this prolonged downtime, Plaintiffs and the other Class members were unable to access PSN,
12   Qriocity, and SOE, unable to play multi-player online games with others, and unable to use online
13   services available through the PSN, Qriocity or SOE. Plaintiffs and the other Class members were also
14   unable to access and use prepaid Third Party Services. [See Id. ¶¶ 9-11, 14, 98.]
15             Between April 21 and April 25, 2011, while the PSN and Qriocity remained off-line, Plaintiffs
16   claim Sony continued to misrepresent the circumstances of the breach. [Id. ¶¶ 54-55, 58.] It was not
17   until April 26, 2011, that Sony finally told the public that the personal information had been taken. [Id. ¶
18   59.] Shortly thereafter, Sony admitted that its failures “may have had a financial impact on our loyal
19   customers. We are currently reviewing options and will update you when the service is restored.” [Id. ¶
20   60.] Sony also conceded that “[s]ome games may require access to PSN for trophy sync, security
21   checks or other network functionality and therefore cannot be played offline.” [Id.] On May 12, 2011,
22   Sony announced that it would compensate SOE users in the United States by offering free identity theft
23   protection services, certain free downloads and online services, and “will consider” helping customers
24   who have been issued new credit cards. [Id. ¶ 66.]
25             Plaintiffs further allege that Sony knew, or should have known, that its security measures were
26   inadequate and that its network was vulnerable to attack because its network had been previously
               On April 1, 2011, SCEA transferred its online PSN and Qriocity service operations to SNEA,
28   including transferring Plaintiffs’ and other Class members’ Personal Information to SNEA for handling.
     [Id.¶ 39.

                                                                                                                                                          3                                                                                                                              11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      444      ooofff      333666

 1   compromised. In 2011, after a PS3 user successfully “jailbroke” his PS3 console and posted instruc-
 2   tions for doing it, Sony sued him to chill others from doing the same.4 [Id. ¶ 69.] However, according
 3   to Plaintiffs, Sony did nothing to update its inadequate protocols or otherwise implement adequate
 4   safeguards. [Id. ¶ 75.] Moreover, in a May 1, 2011 admission, Sony Corporation Chief Information
 5   Officer Shinji Hasejima conceded that Sony’s Network was not secure at the time of the data breach and
 6   that the attack was a “known vulnerability.” [Id. ¶ 76.] According to Plaintiffs, this is further evidenced
 7   by Sony’s decision to not install and maintain appropriate firewalls on its networks, including the
 8   Payment Card Industry Data Security Standard (“PCI DSS”), which requires anyone collecting payment
 9   card information to install and maintain a firewall and is standard in the industry. [Id. ¶ 83.]
10   II.       Procedural History
11             This case is before the Court pursuant to 28 U.S.C. § 1407. On August 16, 2011, the Judicial
12   Panel on Multi-District Litigation transferred certain civil actions from multiple district courts across the
13   country into one consolidated action. [Doc. No. 1.] On November 11, 2011, this Court appointed a
14   Liaison Counsel and a Plaintiffs’ Steering Committee (“PSC”) to streamline the process. [Doc. No. 61.]
15   Thereafter, Plaintiffs were informed that the PSC should file a Consolidated Complaint on behalf of all
16   Plaintiffs, and the Defense could respond to the Consolidated Complaint. [Doc. No. 63.] Plaintiffs filed
17   their Consolidated Class Action Complaint on January 31, 2012, [Doc. No. 78], and Defendants filed the
18   instant motion to dismiss, [Doc. No. 94].5
19                                                                                                                     LEGAL STANDARDS
20   I.        Motion to Dismiss Under Rule 12(b)(1)
21             A Rule 12(b)(1) motion to dismiss tests whether a complaint alleges grounds for federal subject
22   matter jurisdiction. If the plaintiff lacks standing under Article III of the U.S. Constitution, then the
23   court lacks subject matter jurisdiction, and the case must be dismissed. See Steel Co. v. Citizens for a
24   Better Env't, 523 U.S. 83, 101–02, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998).
26             4
              This prompted an Internet activist group known as “Anonymous” to warn Sony in online,
     public postings, “You have abused the judicial system in an attempt to censor information on how your
27   products work . . . Now you will experience the wrath of Anonymous . . . Expect us.” [Id. ¶ 74.]
28             5
              The Court previously denied Plaintiffs’ motions to remand related case Nos.: 11cv2119
     (Detert) and 11cv2120 (Hinkle).

                                                                                                                                                          4                                                                                                                              11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      555      ooofff      333666

 1             A jurisdictional challenge may be facial or factual. Safe Air for Everyone v. Meyer, 373 F.3d
 2   1035, 1039 (9th Cir.2004). Where the attack is facial, the court determines whether the allegations
 3   contained in the complaint are sufficient on their face to invoke federal jurisdiction, accepting all
 4   material allegations in the complaint as true and construing them in favor of the party asserting
 5   jurisdiction. See Warth v. Seldin, 422 U.S. 490, 501, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975). Where the
 6   attack is factual, however, “the court need not presume the truthfulness of the plaintiff's allegations.”
 7   Safe Air for Everyone, 373 F.3d at 1039. In resolving a factual dispute as to the existence of subject
 8   matter jurisdiction, a court may review extrinsic evidence beyond the complaint without converting a
 9   motion to dismiss into one for summary judgment. See id.; McCarthy v. United States, 850 F.2d 558,
10   560 (9th Cir.1988) (holding that a court “may review any evidence, such as affidavits and testimony, to
11   resolve factual disputes concerning the existence of jurisdiction”). Once a party has moved to dismiss
12   for lack of subject matter jurisdiction under Rule 12(b)(1), the opposing party bears the burden of
13   establishing the Court’s jurisdiction. See Kokkonen v. Guardian Life Ins. Co., 511 U.S. 375, 377, 114
14   S.Ct. 1673, 128 L.Ed.2d 391 (1994); Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122
15   (9th Cir.2010).
16   II.       Motion to Dismiss Under Rule 12(b)(6) and Rule 9(b)
17             A complaint must contain “a short and plain statement of the claim showing that the pleader is
18   entitled to relief.” Fed.R.Civ.P. 8(a)(2009). A motion to dismiss pursuant to Rule 12(b)(6) of the
19   Federal Rules of Civil Procedure tests the legal sufficiency of the claims asserted in the complaint.
20   Fed.R.Civ.P. 12(b)(6); Navarro v. Block, 250 F.3d 729, 731 (9th Cir.2001). The court must accept all
21   factual allegations pleaded in the complaint as true, and must construe them and draw all reasonable
22   inferences from them in favor of the nonmoving party. Cahill v. Liberty Mutual Ins. Co., 80 F.3d 336,
23   337–38 (9th Cir.1996). The Court is not bound, however, to accept “legal conclusions” as true. Ashcroft
24   v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 1949–50, 173 L.Ed.2d 868 (2009).
25             To avoid a Rule 12(b)(6) dismissal, a complaint need not contain detailed factual allegations;
26   rather, it must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp.
27   v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). However, “a plaintiff’s
28   obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief’ requires more than labels and

                                                                                                                                                          5                                                                                                                              11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      666      ooofff      333666

 1   conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Id. at 555, 127
 2   S.Ct. 1955 (citation omitted). “Factual allegations must be enough to raise a right to relief above the
 3   speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in
 4   fact).” Id. (citation omitted). In spite of the deference the court is bound to pay to the plaintiff's
 5   allegations, it is not proper for the court to assume that “the [plaintiff] can prove facts that [he or she]
 6   has not alleged or that defendants have violated the ... laws in ways that have not been alleged.”
 7   Associated Gen. Contractors of Cal., Inc. v. Cal. State Council of Carpenters, 459 U.S. 519, 526, 103
 8   S.Ct. 897, 74 L.Ed.2d 723 (1983).
 9             But “[w]hen there are well-pleaded factual allegations, a court should assume their veracity and
10   then determine whether they plausibly give rise to an entitlement to relief.” Id. at 1950. A claim has
11   “facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable
12   inference that the defendant is liable for the misconduct alleged.” Id. at 1949 (citing Twombly, 550 U.S.
13   at 556, 127 S.Ct. 1955). “The plausibility standard is not akin to a ‘probability requirement,’ but it asks
14   for more than a sheer possibility that a defendant has acted unlawfully.” Id. “Where a complaint pleads
15   facts that are ‘merely consistent with’ a defendant's liability, it ‘stops short of the line between
16   possibility and plausibility of entitlement to relief.’” Id. (quoting Twombly, 550 U.S. at 557, 127 S.Ct.
17   1955).
18             Complaints alleging fraud must satisfy the heightened pleading requirements of Federal Rule of
19   Civil Procedure 9(b). Rule 9(b) requires that in all averments of fraud or mistake, the circumstances
20   constituting fraud or mistake shall be stated with particularity. Malice, intent, knowledge, and other
21   conditions of a person’s mind may be alleged generally. A pleading is sufficient under Rule 9(b) if it
22   “state[s] the time, place and specific content of the false representations as well as the identities of the
23   parties to the misrepresentation.” Misc. Serv. Workers, Drivers & Helpers v. Philco–Ford Corp., 661
24   F.2d 776, 782 (9th Cir.1981) (citations omitted); see also Vess v. Ciba–Geigy Corp. USA, 317 F.3d
25   1097, 1106 (9th Cir.2003) (quoting Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir.1997)) (“Averments of
26   fraud must be accompanied by ‘the who, what, when, where, and how’ of the misconduct charged.”).
27   Additionally, “the plaintiff must plead facts explaining why the statement was false when it was made.”
28   Smith v. Allstate Ins. Co., 160 F.Supp.2d 1150, 1152 (S.D.Cal.2001) (citation omitted); see In re

                                                                                                                                                          6                                                                                                                              11md2258
            !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      777      ooofff      333666

 1   GlenFed, Inc. Sec. Litig., 42 F.3d 1541, 1549 (9th Cir.1994) (en banc) (superseded by statute on other
 2   grounds).
 3              Regardless of the title given to a particular claim, allegations grounded in fraud are subject to
 4   Rule 9(b)’s pleading requirements. See Vess, 317 F.3d at 1103–04. Even where fraud is not an essential
 5   element of a consumer protection claim, Rule 9(b) applies where a complaint “rel[ies] entirely on [a
 6   fraudulent course of conduct] as the bases of that claim ... the claim is said to be ‘grounded in fraud’ or
 7   to ‘sound in fraud,’ and the pleading ... as a whole must satisfy the particularity requirement of Rule
 8   9(b).” Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir.2009) (quoting Vess, 317 F.3d at
 9   1103–04); Bros. v. Hewlett–Packard Co., No. C–06–02254 RMW, 2006 WL 3093685, at *7
10   (N.D.Cal.2006).
11   III.       Leave to Amend
12              Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely given
13   when justice so requires,” bearing in mind “the underlying purpose of Rule 15 to facilitate decision on
14   the merits, rather than on the pleadings or technicalities.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th
15   Cir.2000) (en banc) (internal quotation marks and alterations omitted). When dismissing a complaint for
16   the failure to state a claim, “ ‘a district court should grant leave to amend even if no request to amend
17   the pleading was made, unless it determines that the pleading could not possibly be cured by the
18   allegation of other facts.’ ” Id. at 1130 (quoting Doe v. United States, 58 F.3d 494, 497 (9th Cir.1995)).
19   Generally, leave to amend shall be denied only if allowing amendment would unduly prejudice the
20   opposing party, cause undue delay, or be futile, or if the moving party has acted in bad faith.
21   Leadsinger, Inc. v. BMG Music Publ'g, 512 F.3d 522, 532 (9th Cir.2008).
22                                                             SUPPLEMENTAL REQUEST FOR JUDICIAL NOTICE
23              In support of the instant motion, Sony has requested that the Court take judicial notice of six
24   documents: (1) the SNE PlayStation Network and Qriocity Services Terms of Service and User
25   Agreement (“SNE User Agreement”); (2) the SNE PlayStation Network and Qriocity Services Privacy
26   Policy (“SNE Privacy Policy”); (3) the SCEA Privacy Policy (“SCEA Privacy Policy”); (4) an
27   announcement from SCEA and SNE regarding the PSN service outage, entitled, “Update on PlayStation
28   Network and Qriocity” (“Announcement Update”); (5) a CNET article by author Erica Ogg, entitled,

                                                                                                                                                           7                                                                                                                              11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      888      ooofff      333666

 1   “Sony to Restore PSN Services, Compensate Customers” (“CNET Article”); and (6) a published
 2   guidance from the California Office of Privacy Protection (“Privacy Protection Guidelines”). Plaintiffs
 3   only oppose the Privacy Protection Guidelines, arguing admission of the document is inappropriate on a
 4   motion to dismiss as it admits facts outside the pleadings.
 5                 Rule 201 of the Federal Rules of Evidence allows courts to take judicial notice of matters that
 6   are “capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably
 7   be questioned.” Fed.R.Evid. 201(b). The Court may take judicial notice on a motion to dismiss under
 8   Rule 12(b)(6). Lee v. City of Los Angeles, 250 F.3d 668, 688–89 (9th Cir.2001); Silicon Graphics, 183
 9   F.3d at 986. Moreover, “a court may consider a writing referenced in a complaint but not explicitly
10   incorporated therein, if the complaint relies on the document and its authenticity is unquestioned.” Id.
11   (quoting Parrino v. FHP, Inc., 146 F.3d 699, 706 (9th Cir.1998), superseded by statute on other grounds
12   as stated in Abrego v. Dow Chem. Co., 443 F.3d 676 (9th Cir.2006)). According, the SNE User
13   Agreement, SNE Privacy Policy, SCEA Privacy Policy, Announcement Update, and CNET Article are
14   all appropriate for judicial notice as Plaintiffs rely on and quote from each of the documents in the
15   Consolidated Complaint, and do not question their authenticity.
16             Although the Privacy Protections Guidelines are also subject to judicial notice because they can
17   be downloaded from a public agency’s website, the document cannot be used as proof of the matters
18   asserted therein. See Cachil Dehe Band of Wintun Indians of the Colusa Indian Comm'ty v. Cal., 547
19   F.3d 962, 968–69 n. 4 (9th Cir.2008) (taking judicial notice of gaming compacts located on official
20   California Gambling Control Commission website); Santa Monica Food Not Bombs v. City of Santa
21   Monica, 450 F.3d 1022, 1025 n. 2 (9th Cir.2006) (taking judicial notice of “public records” that “can be
22   accessed at Santa Monica’s official website”). This means that factual information asserted in the
23   document cannot be used to create or resolve disputed issues of material fact.” Coalition for a Sustain-
24   able Delta v. McCamman, 725 F.Supp.2d 1162, 1183–84 (E.D.Cal.2010) (emphasis added). Accord-
25   ingly, the Court takes judicial notice of all requested documents, but only takes judicial notice of the
26   Privacy Protections Guidelines to the extent that they exist, and not for the content cited therein.
27   //
28   //

                                                                                                                                                          8                                                                                                                              11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      999      ooofff      333666

 1                                                                                                                                  DISCUSSION
 2             Sony moves to dismiss Plaintiffs’ Consolidated Complaint on the following grounds: (1)
 3   Plaintiffs lack standing to assert causes of action against SOE and SCA; (2) Plaintiffs lack Article III
 4   standing as to all Defendants; (3) Plaintiffs fail to state a claim for negligence because they have not
 5   alleged any cognizable injury; (4) Plaintiffs fail to state a claim under the UCL, FAL, or CLRA, as to
 6   both non-resident class members and resident class members; (5) Plaintiffs’ UCL and FAL claims fail
 7   for lack of any basis to award restitution or injunctive relief; (6) Plaintiffs’ CLRA claim independently
 8   fails because it is inapplicable to the transaction at issue; (7) Plaintiffs’ claim under the Database Breach
 9   Act fails both as to the non-resident class members and to resident class members as a matter of law; (8)
10   Plaintiffs fail to state a claim for Unjust Enrichment because there is no such independent cause of
11   action in California; and (8) Plaintiffs fail to state a claim for bailment because the relationship and
12   transaction necessary to support a claim does not exist in this case. The Court addresses each ground for
13   dismissal in turn.
14   I.        Article III Standing
15             Sony challenges Plaintiffs’ Article III standing to bring the present action. Presumably, Sony
16   does so under Fed.R.Civ.P. 12(b)(1), which allows dismissal of an action for lack of subject matter
17   jurisdiction. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir.2010) (“Because
18   standing and ripeness pertain to federal courts’ subject matter jurisdiction, they are properly raised in a
19   Rule 12(b)(1) motion to dismiss.”).
20             To establish Article III standing, Plaintiffs must demonstrate that they satisfy three requirements:
21   (1) they have suffered an “injury in fact,” i.e., “an invasion of a legally protected interest which is (a)
22   concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical;” (2) the injury is
23   “fairly traceable to the challenged action of the defendant;” and (3) it is “likely, as opposed to merely
24   speculative, that the injury will be redressed by a favorable decision.” Lujan v. Defenders of Wildlife,
25   504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (internal citations, quotation marks, and
26   alterations omitted); accord Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S.
27   167, 180–81, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000). When a plaintiff seeks prospective relief, in order
28   to establish standing, he or she must show that there is “a likelihood of future injury.” See White v. Lee,

                                                                                                                                                          9                                                                                                                              11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111000      ooofff      333666

 1   227 F.3d 1214, 1242 (9th Cir.2000); Gest v. Bradbury, 443 F.3d 1177, 1181 (9th Cir.2006) (plaintiff
 2   must show that he or she is “realistically threatened by repetition of the violation”). “Past exposure to
 3   illegal conduct does not itself show a present case or controversy regarding injunctive relief if unaccom-
 4   panied by any continuing, present adverse effects.” Lujan, 504 U.S. at 564 (internal quotations omitted).
 5              Plaintiffs bear the burden of establishing standing. Lujan, 504 U.S. at 561. In a class action
 6   context, named plaintiffs representing a class “must allege and show that they personally have been
 7   injured, not that injury has been suffered by other, unidentified members of the class to which they
 8   belong and which they purport to represent.” Gratz v. Bollinger, 539 U.S. 244, 289, 123 S.Ct. 2411, 156
 9   L.Ed.2d 257 (2003) (internal quotation marks and citations omitted). “[I]f none of the named plaintiffs
10   purporting to represent a class establishes the requisite of a case or controversy with the defendants,
11   none may seek relief on behalf of himself or any other member of the class.” O'Shea v. Littleton, 414
12   U.S. 488, 494, 94 S.Ct. 669, 38 L.Ed.2d 674 (1974); accord Lierboe v. State Farm Mut. Auto. Ins. Co.,
13   350 F.3d 1018, 1022 (9th Cir.2003). Thus, to survive Sony’s motion, Plaintiffs must allege facts that, if
14   proven, would confer standing upon them. See Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136,
15   1140 (9th Cir.2003); see also Lujan, 504 U.S. at 561 (noting that at pleadings stage, “general factual
16   allegations of injury resulting from the defendant's conduct may suffice” to demonstrate standing).
17              Here, Sony’s standing argument is two-fold. First, Sony contends the named plaintiffs fail to
18   allege any basis for standing against SOE and SCA; and second, Plaintiffs fail to allege an “injury in
19   fact” or establish there is a “casual connection” between the alleged misconduct and a “legally protected
20   interest.”
21              1.                      Standing to Assert Claims Against SOE and SCA
22              Sony first argues that the named Plaintiffs lack standing and fail to state any claim as to two of
23   the Sony Defendants—SOE and SCA—and that the Consolidated Complaint should be dismissed in its
24   entirety as to them. Specifically, Sony contends that none of the named Plaintiffs alleges that he/she was
25   a registered user with the SOE Network, provided any information to SOE, or had any subscriptions
26   with SOE. Likewise, the Consolidated Complaint references SCA only in Paragraph 19, and alleges
27   nothing more than that the other defendants are SCA’s subsidiaries. Plaintiffs respond, stating that
28   because “Defendants acted together by contributing to Sony’s failure to secure its Network,” all

                                                                                                                                                        10                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111111      ooofff      333666

 1   Defendants are equally liable for the Data Breach. [Doc. No. 107, 9.] Plaintiffs further attempted to
 2   bolster this allegation at the motion hearing by stating that all the Defendants work together to provide a
 3   specific product, and that SCA was the entity responsible for selling Sony devices in the United States.
 4   Finally, Plaintiffs also acknowledged at the hearing that although no current Class representatives
 5   subscribe to SOE, such defect could be remedied by adding an additional named Class representative.
 6              On consideration of the parties moving papers and oral arguments advanced at the hearing, the
 7   Court finds that Plaintiffs have failed to currently allege any basis for standing against SOE or SCA.
 8   See, e.g., Easter v. Am. West Fin., 381 F.3d 948, 961-62 (dismissing claims for lack of standing where
 9   plaintiffs failed to trace the alleged injury-in-fact to the conduct of certain defendants); Cattie v.
10   Wal-Mart Stores, Inc., 504 F. Supp. 2d 939, 944-46 (S.D. Cal. 2007) (plaintiffs lacked standing against
11   one Wal-Mart entity where they relied solely on allegations that it acted jointly with other Wal-Mart
12   entities); Simon v. E. Ky Welfare Rights Org., 426 U.S. 26, 40 n.20 (1976) (findings that even in a
13   putative class action, each named plaintiff must personally allege a cognizable and traceable injury).
14   Specifically, Plaintiffs have failed to show that any of the named Class representatives subscribe to
15   SOE, or sufficiently allege a definitive relationship between SCA and the other Sony Defendants.
16   Accordingly, the Court DISMISSES Plaintiffs’ claims against SOE and SCA with leave to amend.
17              2.                      Injury in Fact and Causal Connection as to All Defendants
18              Second, Sony claims the named Class representations lack standing with respect to all Defen-
19   dants for failure to allege any injury-in-fact or causal connection between the alleged misconduct and a
20   legally protected interest. With respect to injury-in-fact, Sony argues that exposure of personal
21   information alone does not constitute Article III standing because Plaintiffs have not alleged that the
22   Data Breach resulted in the theft of their identities or unauthorized use of their Personal Information.
23   Moreover, the only two named Class members who have alleged a cognizable loss—Mr. Johnson and
24   Mr. Howe—fail to show that they were either required to pay out-of-pocket for the fraudulent charges or
25   why standing can be generated merely by spending money on perceived preventive measures.

                                                                                                                                                        11                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111222      ooofff      333666

 1   Specifically, Sony states that Johnson does not allege that the unauthorized charges resulted from the
 2   Data Breach, or that he was required to pay out-of-pocket for the charges, and that Howe fails to allege
 3   “actual” misuse of his data, or what it means that his account was “compromised.”6
 4              Conversely, Plaintiffs argue that the mere exposure of their Personal Information is enough to
 5   satisfy the injury-in-fact requirement because such exposure has subjected them to an increased risk of
 6   identity theft and fraud. Additionally, Plaintiffs contend that Class members have suffered more than
 7   just an “exposure of their personal information,” as alleged by Sony, because they were injured as a
 8   result of Sony’s month-long SOS shutdown, the loss of use of their hardware (thereby diminishing its
 9   value), the loss of use of the PSN, and the loss of use of pre-paid Third Party Services.7
10              On the issue of Article III standing, both Sony and Plaintiffs point to Krottner v. Starbucks
11   Corp., 628 F.3d 1139, 1143 (9th Cir. 2010), in which the Ninth Circuit recognized that exposure of
12   personal information constitutes injury-in-fact only where the plaintiffs face “a credible threat of real
13   and immediate harm,” as opposed to harm that is simply “conjectural or hypothetical.” According to
14   Sony, because Plaintiffs do not allege that any unauthorized use actually occurred, in the form of opened
15   accounts, the harm is conjectural and hypothetical, rather than imminent. Sony claims numerous other
16   courts have recognized that where, as here, the facts do not show anything more than alleged exposure
17   of Plaintiffs’ information, Article III’s injury requirement is not satisfied.8 Plaintiffs respond that the
18   situation is analogous to Krottner, wherein the Ninth Circuit held that when personal information has
               Mr. Johnson alleged fraudulent credit card charges and Mr. Howe alleged he incurred credit
20   monitoring costs as a result of the Data Breach. Sony alleges neither has sustained an injury-in-fact.
     See e.g., Anderson v. Hannaford Bros., 659 F.3d 151, 155 n.2, 167 (1st Cir. 2011) (dismissing all the
21   claims of all named plaintiffs who alleged fraudulent charges that were later reimbursed).
22              7
               Plaintiffs did not specifically respond to Sony’s contentions regarding Johnson and Howe.
     However, Plaintiffs stated that the losses asserted are “direct financial injuries to Plaintiffs and other
23   Class members, and such economic losses have always conferred Article III standing. [Doc. No. 107,
     11: 1-4.]
              In support of this contention Sony points to many out of state cases. As such, these sources are
25   only persuasive and not binding authority. See Reilly v. Ceridian Corp., 664 F.3d 38, 42-46 (3d Cir.
     2011) (dismissing plaintiffs’ claims for lack of injury because plaintiffs’ contentions that the hacker
26   obtained the information with the intent of misusing it, and was in fact able to do so, were
     speculative—noting that “unless and until these conjectures come true, [plaintiffs] have not suffered any
27   injury”) (emphasis added); Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d 1046, 1053 (E.D. Mo.
     2009) (granting motion to dismiss); Key v. DSW, Inc., 454 F. Supp. 2d 684, 691 (S.D. Ohio 2006)
28   (granting motion to dismiss); Hammond v. Bank of N.Y. Mellon Corp., No. 08 Civ. 6060(RMB)(RLE),
     2010 WL 2643307, at *7 (S.D.N.Y. June 25, 2010) (granting summary judgment for defendant).

                                                                                                                                                        12                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111333      ooofff      333666

 1   been stolen but not yet misused, plaintiffs have suffered an injury sufficient to confer standing under
 2   Article III.
 3              In Krottner, Plaintiffs were Starbucks employees whose personal information, including names,
 4   addresses, and social security numbers were compromised as the result of the theft of a company laptop.
 5   Krottner, 628 F.3d at 1140. Class members brought an action against Starbucks, alleging negligence and
 6   breach of contract. Id. at 1139. The Ninth Circuit held that the plaintiffs satisfied the injury-in-fact
 7   requirement through their allegations of increased risk of future identify theft because they had “alleged
 8   a credible threat of real and immediate harm stemming from the theft of a laptop containing their
 9   unencrypted personal data.” Id. at 1143. In reaching its decision, the Ninth Circuit relied on analogous
10   reasoning in environmental claims, wherein a plaintiff may allege a future injury in order to comply with
11   the injury-in-fact requirement. Id. at 1142 (quoting Cent. Delta Water Agency v. United States, 306 F.3d
12   938, 948–50 (9th Cir.2002). Thus, where sensitive personal data, such as names, addresses, social
13   security numbers and credit card numbers are improperly disclosed or disseminated into the public,
14   increasing the risk of future harm, injury-in-fact has been recognized. Id. at 1139; Doe 1 v. AOL, 719
15   F.Supp.2d 1102, 1109-11 (N.D. Cal. 2010).
16              Here, the Court finds Plaintiffs have articulated sufficient particularized and concrete harm to
17   sustain a finding of injury-in-fact at this stage in the pleadings. Similar to the plaintiffs in Krottner,
18   Plaintiffs allege that their sensitive Personal Information was wrongfully disseminated, thereby
19   increasing the risk of future harm. Thus, even though Sony alleges no harm has yet occurred, in certain
20   circumstances, as the Court finds pertinent here, future harm may be regarded as a cognizable loss
21   sufficient to satisfy Article III’s injury-in-fact requirement. See Krottner, 628 F.3d at 1142 (“A plaintiff
22   may allege a future injury in order to comply with [the injury-in-fact] requirement, but only if he or she
23   ‘is immediately in danger of sustaining some direct injury as the result of the challenged ... conduct and
24   the injury or threat of injury is both real and immediate, not conjectural or hypothetical.’ ”) (quoting
25   City of Los Angeles v. Lyons, 461 U.S. 95,102, 103 S.Ct. 1660 (1983)).
26              With respect to the “causal connection” requirement under Article III, Sony contends Plaintiffs
27   do not allege that they relied upon any promise by Sony of uninterrupted service or any warranty against
28   intrusion. Sony argues that in order for Plaintiffs to allege they received or relied on Sony’s representa-

                                                                                                                                                        13                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111444      ooofff      333666

 1   tions they had to have purchased rather than acquired their consoles.9 Moreover, Sony contends that
 2   even if Plaintiffs could show a causal connection, the “Terms of Service and Privacy Policy for the PSN
 3   disclaim both.” [Doc. No. 94, 10:7-16.] Plaintiffs counter, stating that they have plainly plead not only
 4   that it was Sony’s inadequate network security that enabled the Data Breach, but also that Sony knew its
 5   security was inadequate, experienced other Network breaches, and failed to implement fixes. Moreover,
 6   Plaintiffs assert it makes no difference whether they “paid good money” for their devices or whether the
 7   devices were acquired by gift, as every Plaintiff was injured by the nearly month-long intentional
 8   disruption of service and loss of use of the SOS and other dependent services.10
 9              Here, as stated above, Plaintiffs’ Consolidated Class Action Complaint is sufficient to support
10   the causal connection element of Article III at this early stage in the proceedings. As the Supreme Court
11   has noted, the evidence required to support or oppose Article III standing will necessarily increase as the
12   litigation progresses. See Lujan, 504 U.S. at 561, 112 S.Ct. 2130 (1992) (“Since they are not mere
13   pleading requirements but rather an indispensable part of the plaintiff's case, each [constitutional
14   standing] element must be supported in the same way as any other matter on which the plaintiff bears
15   the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the
16   litigation.”) Therefore, the Court finds Plaintiffs have sufficiently plead injury-in-fact and a causal
17   connection between the alleged misconduct and a legally protected interest. Accordingly, the Court
18   DENIES Sony’s motion to dismiss the Consolidated Complaint on the basis of lack of Article III
19   standing.11
20   //
21   //
23              9
              See Webb v. Carter's Inc., 272 F.R.D. 489, 498 (C.D. Cal. 2011) (putative class members who
     alleged that they “acquired” rather than “purchased” a defective product did not suffer a cognizable
24   injury for the purposes of standing).
25              10
               See Webb, 272 F.R.D. at 498 (finding that a majority of plaintiffs, regardless of purchase or
     acquisition, suffered no adverse effect).
                However, Plaintiffs must be mindful that Article III standing requirements are an
27   “indispensable part of a plaintiff's case.” Lujan, 504 U.S. at 561. Therefore, if the Court later finds
     Plaintiffs’ injury is hypothetical, speculative, or lacks a causal connection, the Court must conclude
28   Plaintiffs lack standing. Moreover, where actual evidence is required, in the case of summary judgment,
     a much different result could occur in this case.

                                                                                                                                                        14                                                                                                                                 11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111555      ooofff      333666

 1   II.         Motion to Dismiss
 2               The Court next addresses the sufficiency of each of Plaintiffs’ seven claims below, largely in the
 3   order they were raised in Sony’s motion to dismiss, beginning first with Plaintiffs’ negligence claim.
 4   Moreover, because Plaintiffs allege three causes of action that arise under various California consumer
 5   protection statutes, with similar pleading requirements—the UCL, FAL, and CLRA—the Court will
 6   address issues common to those three claims, and will next discuss issues specific to each individual
 7   claim. Finally, the Court will address Plaintiffs’ allegations under California’s Database Breach Act,
 8   and unjust enrichment and bailment causes of action.
 9               A.                      Negligence Claim (Sixth Cause of Action)
10               Under California law, the elements of a negligence cause of action are: (1) the existence of a
11   duty to exercise due care; (2) breach of that duty; (3) causation; and (4) damages. Paz v. California, 22
12   Cal.4th 550, 93 Cal.Rptr.2d 703, 994 P.2d 975, 980–81 (2001). Sony makes three separate arguments
13   that Plaintiffs’ negligence claim fails, all of which are related to whether Plaintiffs have alleged
14   sufficient damages: (1) the economic loss doctrine bars the claim; (2) failure to allege a cognizable
15   injury; and (3) insufficient pleadings under Iqbal and Twombly. Each ground for dismissal will be
16   considered in turn.
17                                       1.                     Economic Loss Doctrine
18               Sony presented substantial support in its moving papers and at the motion hearing to advance its
19   contention that the economic loss doctrine bars Plaintiffs’ negligence claim. According to Sony,
20   Plaintiffs’ damages consist entirely of “economic damages” associated with “credit monitoring, loss of
21   use and value of [PSN] services, loss of use and value of prepaid Third Party Services, and diminution
22   of the value of their PS3s and/or PSPs.” [Doc. No. 78 ¶ 180.] Furthermore, Sony claims courts in
23   numerous other data breach cases have recognized that such economic losses are not recoverable under

                                                                                                                                                         15                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111666      ooofff      333666

 1   a negligence theory.12 Accordingly, Sony claims Plaintiffs are attempting to plead around their contract
 2   with SNE, which expressly disclaims any guarantees of uninterrupted service or perfect security.13
 3              Conversely, Plaintiffs assumed, without adequately arguing in either its moving papers or at the
 4   motion hearing, that the doctrine is inapplicable to the case at bar.14 After considering the arguments
 5   presented by the parties and the Court’s independent research, the Court finds that although Sony has
 6   failed to allege that the economic loss doctrine bars Plaintiff’s negligence claim as a matter of law,
 7   Plaintiffs have also failed to allege sufficient facts to assert the doctrine’s non-applicability.
 8              Under the economic loss doctrine, a plaintiff’s tort recovery of economic damages is barred
 9   unless such damages are accompanied by some form of physical harm (i.e., personal injury or property
10   damage).15 See N. Am. Chem. Co. v. Super. Ct., 59 Cal.App.4th 764, 777 (1997). Thus, in actions for
12              12
                However, once again, the cases cited by Sony are only persuasive authority and not binding
     on this Court. See, e.g., In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489, 498-99 (1st Cir. 2009)
13   (affirming dismissal of negligence claims under the Massachusetts economic loss rule); Cumis Ins. Soc.,
     Inc. v. BJs Wholesale Club, Inc., 918 N.E.2d 36, 46-47 (Mass. 2009) (holding that Massachusetts law
14   precluded recovery in negligence for economic loss in data breach case); Pa. State Employees Credit
     Union v. Fifth Third Bank, 398 F. Supp. 2d 317, 330 (M.D. Pa. 2005).
               Sony’s Privacy Policy (which each user must agree to) promises that Sony will “take
16   reasonable measures to protect the confidentiality, security, and integrity of the personal information
     collected from our website visitors” and that “Sony Online Services use industry standard encryption to
17   prevent unauthorized electronic access to sensitive financial information such as your credit card
     number.” [Id. ¶ 42.] However, the Privacy Policy also expressly disclaims any promise of immunity
18   from intrusion: “Unfortunately, there is no such thing as perfect security. As a result, although we strive
     to protect personally identifying information, we cannot ensure or warrant the security of any
19   information transmitted to us through or in connection with our website, Sony Online Services or that
     we store on our systems or that is stored on our service providers' systems.” [See Def.’s RJN, Ex. B, 6.]
             Additionally, Sony’s Terms of Service agreement (which every user must enter into) expressly
21   provides that Sony does not offer any warranty against uninterrupted service: “No warranty is given
     about the quality, functionality, availability or performance of Sony Online Services, or any content or
22   service offered on or through Sony Online Services. . . SNEA does not warrant that the service and
     content will be uninterrupted, error-free or without delays. . . SNEA assumes no liability for any
23   inability to purchase, access, download or use any content, data or service.” [See Def.’s RJN, Ex. A, 9.]
24              14
               At the motion hearing Sony asserted that Plaintiffs failure to address the economic loss
     doctrine in their opposition waived any right to contest the doctrine’s applicability. However, the Court
25   finds that Plaintiffs did mention the doctrine, albeit insubstantially in their opposition, and is nonetheless
     unwilling to dismiss the claim offhandedly and without considering its merits.
                As stated by the court in North American Chemical, “economic loss” includes “damages for
27   inadequate value, costs of repair and replacement of the defective product or consequent loss of
     profits-without any claim of personal injury or damages to other property ....” Sacramento Regional
28   Transit Dist. v. Grumman Flxible (1984) 158 Cal.App.3d 289, 294; 204 Cal.Rptr. 736. Although purely
     economic loss usually occurs in the form of lost profits, it may also include consequential damages, loss

                                                                                                                                                        16                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111777      ooofff      333666

 1   negligence, liability is limited to damages for physical injuries and recovery of economic loss is not
 2   allowed. Aas v. Super. Ct., 24 Cal.4th 627, 101 Cal.Rptr.2d 718, 12 P.3d 1125, 1130-31 (2000) (citing
 3   Seely v. White Motor Co., 63 Cal.2d 9, 45 Cal.Rptr. 17, 403 P.2d 145, 151 (1965)). As stated by the
 4   Ninth Circuit in Kalitta Air, L.L.C. v. Central Texas Airborne Systems, Inc., “in the absence of (1)
 5   personal injury, (2) physical damage to property, (3) a ‘special relationship’ existing between the
 6   parties, or (4) some other common law exception to the rule, recovery of purely economic loss is
 7   foreclosed.” 315 F. App’x 603, 605 (9th Cir. 2008); J'Aire Corp. v. Gregory, 24 Cal.3d 799, 157
 8   Cal.Rptr. 407, 598 P.2d 60, 62-63 (1979). Here, Plaintiffs’ Consolidated Complaint does not assert
 9   personal injuries or physical damage to their consoles. Thus, in order to plead around the economic loss
10   doctrine Plaintiffs must show that there is a “special relationship between the parties” or that some other
11   common law exception, i.e., fraud or intentional misrepresentation, applies. See Giles v. Gen. Motors
12   Acceptance Corp., 494 F.3d 865, 880 (9th Cir. 2007) (finding that the economic loss doctrine did not
13   apply because appellants’ tort claim was not a “mere contract claim cloaked in the language of tort,” as
14   appellants claimed fraud in the inducement rather than fraud in the execution). Under the test articulated
15   by the California Supreme Court in J'Aire, the court looks at six factors to determine the existence of a
16   special relationship: (1) the extent to which the transaction was intended to affect the plaintiff; (2) the
17   foreseeability of harm to the plaintiff; (3) the degree of certainty that the plaintiff suffered injury; (4) the
18   closeness of the connection between the defendant’s conduct and the injury suffered; (5) the moral
19   blame attached to the defendant’s conduct; and (6) the policy of preventing future harm. Kalitta Air,
20   315 F. App’x at 605-06. All six factors must be considered by the court, and the presence or absence of
21   one factor is not decisive. Id.
22              In the present case, although Plaintiffs stated at the motion hearing that the applicability of the
23   economic loss doctrine is contingent on whether the negligence claim arises out of a contract for
24   services, as opposed to a contract for the sale of goods or products, the Ninth Circuit has disregarded
25   such a rudimentary distinction. Id. In doing so, the Ninth Circuit stated that if they were to “hold that
27   of expected proceeds, lost opportunities, diminution in the value of the allegedly defective property, the
     costs of repair and replacement, loss of use, loss of goodwill, and damages paid to third parties as a
28   result of a defendant's negligence. See Segalla & Nowak, Economic Loss Rule: Foreseeability
     -Dialogue of the 90's? (Fall, 1994) 45 Fed'n. of Ins. & Corp. Couns. Q. 25, 26.).

                                                                                                                                                        17                                                                                                                                 11md2258
           !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111888      ooofff      333666

 1   the economic loss rule does not apply to a claim grounded in the performance of services, the district
 2   court must still apply the six criteria set forth in J'Aire to justify recovery of economic loss caused by
 3   the negligent performance of a contract.” See North American, 69 Cal.Rptr.2d at 479 (stating that the
 4   economic loss rule did not bar a negligence claim grounded in the negligent performance of services and
 5   applying the J'Aire criteria to justify recovery of economic loss caused by negligent performance of a
 6   contract); Zamora v. Shell Oil Co., 55 Cal.App.4th 204, 63 Cal.Rptr.2d 762, 766 (1997) (“J'Aire sets
 7   forth a limited exception to the general rule that economic loss alone is insufficient to state a negligence
 8   cause of action . . . ”).
 9               Therefore, the economic loss rule will not bar Plaintiffs’ negligence claim so long as Plaintiffs
10   can satisfy the multi-factor “special relationship” test applied in J'Aire, or can set forth some other
11   common law exception to the rule. See J'Aire, 157 Cal.Rptr. 407, 598 P.2d at 63; Aas, 101 Cal.Rptr.2d
12   718, 12 P.3d at 1137-40 (applying J'Aire ); Ales-Peratis Foods, 209 Cal.Rptr. at 921 (same); North
13   American, 69 Cal.Rptr.2d at 479 (same). However, because Plaintiffs’ Consolidated Complaint has
14   failed to adequately allege why the economic loss doctrine does not apply, in particular why the J'Aire
15   factors weigh in favor of finding a “special relationship,” or allege actionable misrepresentations made
16   by Sony that were justifiably relied on, Plaintiffs’ negligence claim must fail. See e.g., Robinson
17   Helicopter Co., Inc. v. Dana Corp., 34 Cal. 4th 979, 990-91, 102 P.3d 268, 274 (2004) (finding the
18   economic loss doctrine did not apply because plaintiff would not have accepted delivery and used the
19   nonconforming goods, nor would it have incurred the cost of investigating the cause of the faulty
20   product, had it not been for Defendants’ intentional misrepresentations upon which Plaintiff relied).
21   Accordingly, the Court finds Plaintiffs have failed to allege why the economic loss doctrine does not bar
22   their negligence claim.
23                                       2.                     Cognizable Injury
24               Second, Sony argues that even if Plaintiffs’ claim is not barred by the economic loss doctrine,
25   the damages element of a negligence action requires Plaintiffs to show they have suffered some
26   cognizable injury. Here, as discussed above, no Plaintiff alleges any identity theft or unauthorized use
27   of his information causing a pecuniary loss. Sony claims courts have consistently held that mere
28   allegations of exposure of a plaintiff’s personal information are insufficient to establish a cognizable

                                                                                                                                                         18                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      111999      ooofff      333666

 1   injury.16 In response, Plaintiffs assert they were injured because their Personal Information was stolen,
 2   which has exposed them to an increased risk of identity theft and fraud. Plaintiffs further allege they
 3   suffered injury related to the loss of use and value of SOS, the loss of use and value of prepaid Third
 4   Party Services, and the diminution of value of their PS3s and/or PSPs.
 5              Under California law, appreciable, nonspeculative, present harm is an essential element of a
 6   negligence cause of action. Aas v. Super. Ct., 24 Cal.4th 627, 646, 101 Cal.Rptr.2d 718, 12 P.3d 1125
 7   (2000); Ruiz v. Gap, Inc., 622 F.Supp.2d 908, 913 (N.D. Cal. 2009), aff’d, 380 Fed. App’x 689 (9th Cir.
 8   2010). The breach of a duty causing only speculative harm or the threat of future harm does not
 9   normally suffice to create a cause of action for negligence. See id.; see also Zamora v. Shell Oil Co., 55
10   Cal.App.4th 204, 211, 63 Cal.Rptr.2d 762 (4th Dist.1997) (finding there has not been the requisite
11   damage for a negligence cause of action where defective water pipes had not yet leaked); San Francisco
12   Unified Sch. Dist. v. W.R. Grace & Co., 37 Cal.App.4th 1318, 1327-30, 44 Cal.Rptr.2d 305 (.1995)
13   (finding that presence of asbestos products in buildings did not satisfy damage element of negligence
14   cause of action when products had not contaminated buildings by releasing friable asbestos); Khan v.
15   Shiley, Inc., 217 Cal.App.3d 848, 857, 266 Cal.Rptr. 106 (4th Dist.1990) (no cause of action for
16   negligence premised on risk that implanted heart valve may malfunction in the future).
17              While Plaintiffs have currently alleged enough to assert Article III standing to sue based on an
18   increased risk of future harm, the Court finds such allegations insufficient to sustain a negligence claim
19   under California law. See Ruiz, 406 Fed. App’x.129, 130 (affirming the district court’s dismissal of the
20   negligence claim for failure to adequately allege a cognizable injury because even though plaintiff-
21   appellants pled an injury-in-fact for purposes of Article III standing they did not adequately plead
22   damages for purposes of their state-law claims.) Accordingly, without specific factual statements that
23   Plaintiffs’ Personal Information has been misused, in the form of an open bank account, or un-reim-
24   bursed charges, the mere “danger of future harm, unaccompanied by present damage, will not support a
               Among other cases, Sony cites to Krottner, 406 F. App’x at 131 (affirming dismissal because
26   the plaintiffs failed to allege actual loss or damage required to state a claim for negligence under
     Washington law); Ruiz v. Gap, Inc., 380 F. App’x 689, 691 (9th Cir. 2010) (affirming summary
27   judgment for defendant because the plaintiff failed to allege appreciable damage required to state a
     claim for negligence under California law); Low v. LinkedIn Corp., No. 5:11-cv-01468-LHK, 2011 WL
28   5509848, at *4 (N.D. Cal. Nov. 11, 2011) (denying standing under Article III for plaintiff’s claim that
     his personal information had independent economic value).

                                                                                                                                                        19                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222000      ooofff      333666

 1   negligence action.” Id (quoting Gazija v. Nicholas Jerns Co., 86 Wash.2d 215, 543 P.2d 338, 341
 2   (1975).17
 3              Plaintiffs alterative grounds for cognizable loss fail for similar reasons. First, Plaintiffs fail to
 4   assert a plausible argument, in light of the PSN Terms and Service Agreement to which all Plaintiffs
 5   assented to, establishing a separate and distinct duty to provide continuous and uninterrupted service to
 6   either the PSN or prepaid Third-Party Services. Blanket assertions that Sony “represented that access to
 7   the PSN was a feature of the PSP and PS3” fail to justify a separate and distinct duty of care, and thus
 8   fall short of what is required. See Erlich v. Menezes (1999) 21 Cal.4th 543. 552, 87 Cal.Rptr.2d 886,
 9   981 P.2d 978 (“[I]n each of these cases, the duty that gives rise to tort liability is either completely
10   independent of the contract or arises from conduct which is both intentional and intended to harm.”).
11   Moreover, and potentially most illusory, is Plaintiffs’ allegations that their consoles have diminished in
12   value as a result of the Data Breach. However, as acknowledged by Sony at the motion hearing,
13   Plaintiffs have failed to argue that as a result of the Data Breach Plaintiffs are using their consoles less,
14   or report problems with their devices after the PSN resumed service. Thus, the Court finds Plaintiffs
15   have not currently alleged a cognizable loss stemming from a legal duty to provide such services.
16                                      3.                     Allegations of Negligent Conduct Fail to Satisfy Iqbal and Twombly
17              Third, Sony argues that Plaintiffs’ allegations of negligent conduct and breach of duty fail to
18   satisfy Iqbal and Twombly because they are conclusory and speculative. Sony claims that pointing by
19   hindsight to the fact that an intrusion occurred does not establish or permit an inference that security was
20   not reasonable. Specifically, Sony asserts that parroting unidentified commentary from blogs about
21   inadequate firewalls do not make it plausible that an inadequate firewall was somehow involved in the
22   intrusion. Thus, rather than alleging facts, Plaintiffs resort to arguing that Sony admitted their network
23   security was inadequate, even though such a statement can in no way be regarded as an admission.
24              Although Sony’s arguments may be availing at a later juncture, at this stage in the proceedings
25   Sony’s arguments generalize and mischaracterize Plaintiffs’ claims, especially since Plaintiffs allege
26   that Sony knew of potential problems and failed to implement reasonable safeguards. Thus, because
               Plaintiffs’ opposition states that such authority is not instructive as the Ninth Circuit applied
28   Washington law. However, the Court does not find this argument persuasive because the elements
     required in a negligence action under Washington law and California law are not materially different.

                                                                                                                                                        20                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222111      ooofff      333666

 1   Plaintiffs do not need to prove that Sony’s conduct was in fact negligent, or that they did in fact have
 2   inadequate safeguards, Plaintiffs have satisfied their burden. Accordingly, the Court finds Plaintiffs
 3   have satisfied the requirements of Iqbal and Twombly with respect to their negligence claim. However,
 4   because Plaintiffs’ negligence claim fails for the reasons set forth above, the Court DISMISSES
 5   Plaintiff’s negligence claim with leave to amend.
 6              B.                      Consumer Protection Claims (First, Second, and Third Causes of Action)
 7              Plaintiffs assert various claims under California’s consumer protection statutes alleging
 8   violations of the Unfair Competition Law (“UCL”), False Advertising Law (“FAL”), and the Consumers
 9   Legal Remedies Act (“CLRA”), all of which are based on Sony’s alleged misrepresentations that
10   affected Plaintiffs’ access to the Sony Network and disclosure of their Personal Information. In
11   response, Sony asserts that Plaintiffs’ consumer claims fail as to non-resident named Class members
12   because the alleged misrepresentations occurred outside of California. Additionally, Sony alleges
13   Plaintiffs’ claims fail as to resident Class members because Plaintiffs lack standing, they have failed to
14   allege their claims with sufficient particularity, there is no basis for restitution or injunctive relief, and
15   the CLRA is inapplicable to the transaction at issue. Each basis for dismissal is discussed in turn.
16                                      1.                     Non-Resident Named Plaintiffs
17              Sony first argues that Plaintiffs’ claims under the UCL, FAL, and the CLRA must be dismissed
18   as to the non-resident named Plaintiffs. This argument is inline with the Ninth Circuit’s holding in
19   Mazza v. American Honda Motor Co., wherein the court found that for claims sounding in misrepresen-
20   tation, the governing consumer protection statute is that of the state where the misrepresentation was
21   received. 666 F.3d 581, 593-94 (9th Cir. 2012). See also McCann v. Foster Wheeler LLC, 48 Cal.4th
22   68, 94 n. 12, 105 Cal.Rptr.3d 378, 225 P.3d 516 (pointing out that the geographic location of an
23   omission is the place of the transaction where it should have been disclosed); Zinn v. Ex–Cell–O Corp.,
24   148 Cal.App.2d 56, 80 n. 6, 306 P.2d 1017 (1957) (concluding in fraud cases that the place of the wrong
25   was the state where the misrepresentations were communicated to the plaintiffs, not the state where the
26   intention to misrepresent was formed or where the misrepresented acts took place). Here, four of the six

                                                                                                                                                        21                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222222      ooofff      333666

 1   named Plaintiffs received the alleged misrepresentations outside of California. (Doc. No. 78. ¶¶ 9,
 2   12-14).18
 3              Plaintiffs contend that the choice of law provision in the SNE Terms of Service Agreement
 4   dictates that California law applies to claims relating to their PSN accounts. By its own terms, however,
 5   the provision dictates only that California law applies to the construction and interpretation of the
 6   contract, and thus the provision does not apply to Plaintiffs’ non-contractual claims asserted under
 7   California’s consumer protection statutes. The Court finds Mazza is clear and Plaintiffs misconstrue the
 8   choice of law provision in the SNE Terms and Service Agreement. Accordingly, the Court
 9   DISMISSES Plaintiffs’ claims arising under the UCL, FAL, and the CLRA, with respect to the non-
10   resident named Plaintiffs with prejudice.
11                                      2.                     Standing Under the UCL, FAL and CLRA
12              Sony next argues that Plaintiffs lack standing to sue under California’s consumer protection
13   statutes because they have not alleged a cognizable injury. To maintain standing under the UCL and
14   FAL, a plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as
15   injury in fact, i.e., economic injury; and (2) show that economic injury was the result of, i.e., caused by,
16   the unfair business practice or false advertising that is the gravamen of the claim.” Kwikset Corp. v.
17   Super. Ct., 51 Cal.4th 310, 120 Cal.Rptr.3d 741, 246 P.3d 877, 885 (2011). A plaintiff need not allege
18   eligibility for restitution to establish standing. Id. at 894–95, 120 Cal.Rptr.3d 741. Similarly, the CLRA
19   requires that a plaintiff allege a “tangible increased cost or burden to the consumer.” Meyer v. Sprint
20   Spectrum L.P., 200 P.3d 295, 301 (Cal. 2009). This requires showing “not only that a defendant’s
21   conduct was deceptive but that the deception caused them harm.” In re Vioxx Class Cases, 180
22   Cal.App.4th 116, 129, 103 Cal.Rptr.3d 83, 94 (2009). Generally, the standard for deceptive practices
23   under the fraudulent prong of the UCL applies equally to claims for misrepresentation under the CLRA.
24   See Consumer Advocates v. Echostar Satellite Corp., 113 Cal.App.4th 1351, 1360, 8 Cal.Rptr.3d 22
25   (2003). For this reason, courts often analyze California’s consumer statutes together. See, e.g.,
26   Paduano, 169 Cal.App.4th at 1468–73, 88 Cal.Rptr.3d 90 (analyzing UCL and CLRA claims together).
28           Scott Lieberman lives in Plantation, Florida; Adam Schucher lives in Surfside, Florida;
     Rebecca Mitchell lives in East Lansing, Michigan; and Christopher Wilson lives in Dallas, Texas. Kyle
     Johnsona dn Arthur Howe both live in San Diego, California.
                                                                                                                                                        22                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222333      ooofff      333666

 1              Although the requirements of federal standing under Article III and the requirements of standing
 2   under California’s consumer protection statutes overlap, there are important differences. See Troyk v.
 3   Framers Grp., Inc., 171 Cal.App.4th 1305, 1348-49 (2009). For example, under Article III a plaintiff
 4   must allege: (1) an injury in fact; (2) causation; and (3) likelihood that the injury will be redressed by a
 5   favorable decision. Lujan, supra, 504 U.S. at pp. 560–561, 112 S.Ct. 2130.) Conversely, under the
 6   UCL and FAL, Proposition 64 incorporates into Business and Professions Code section 17204 only the
 7   first element (i.e., an “injury in fact”), but includes two additional requirements not applicable to federal
 8   standing. Thus, even if a plaintiff has established an “injury in fact” for purposes of Article III, he must
 9   also show he has “lost money or property” to maintain an action under the UCL and FAL. See Troyk,
10   171 Cal.App.4th 1305 at 1348-49.
11              Plaintiffs allege they have standing under the UCL, FAL, and CLRA because (1) their Personal
12   Information was compromised; (2) they lost use of their consoles as a result of an interruption in PSN
13   Services; (3) they lost use of Third-Party Services; and (4) they suffered a diminution in value of their
14   PS3s and PSPs. Sony contends that none of Plaintiffs’ alleged losses are a cognizable injury because
15   Plaintiffs have not suffered lost “money or property.” The Court is inclined to agree.
16              First, Plaintiffs’ allegations that the heightened risk of identity theft, time and money spent on
17   mitigation of that risk, and property value in one’s information, do not suffice as injury under the UCL,
18   FAL, and/or the CLRA. See In re iPhone Application Litigation, No. 11-MD-02250-LHK, 2011 WL
19   4403963, at *14 (N.D. Cal. Sept. 20, 2011) (“[n]umerous courts have held that a plaintiff’s ‘personal
20   information’ does not constitute money or property under the UCL”); Ruiz, No.07-5739-SC, 2009 WL
21   2500481 at *3-4 (N.D. cal. Feb. 3, 2009), aff’d, 380 F.App’x at 692 (stating that time and money spent
22   to monitor and repair their credit is not the “kind of loss of money or property necessary for standing to
23   assert a claim under section 17200”).
24              Second, Plaintiffs’ contentions that the interruption of PSN Services and the Data Breach caused
25   damage to the value of their consoles are simply too speculative to constitute “lost money or property.”
26   In order to have “lost money or property” a plaintiff must demonstrate some form of economic injury.
27   Kwikset, 51 Cal.4th at 323. Economic injury can occur in many ways, including, but not limited to,
28   when a plaintiff “(1) surrender[s] in a transaction more, or acquire[s] in a transaction less, than he or she

                                                                                                                                                        23                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222444      ooofff      333666

 1   otherwise would have; (2) [has] a present or future property interest diminished; (3) [is] deprived of
 2   money or property to which he or she has a cognizable claim; or (4) [is] required to enter into a
 3   transaction, costing money or property, that would otherwise have been unnecessary.” Id. Although
 4   this is by no means an exhaustive list to determine whether or not the required harm has been suffered, it
 5   is clear after Proposition 64 that “a private plaintiff filing suit now must establish that he or she has
 6   personally suffered such harm.” Id. Here, Plaintiffs have not alleged their consoles are worth less or
 7   their personal property was damaged as a result of the Data Breach. Moreover, although Plaintiffs’ PSN
 8   Service may have been temporarily suspended, they have not alleged they surrendered more than they
 9   otherwise would have because the PSN Terms and Service Agreement disclaimed any rights to
10   uninterrupted service.
11              Finally, Plaintiffs’ claims of diminution in value of their consoles and/or loss of use of prepaid
12   Third-Party Services also fail to establish a loss of money or property. As reaffirmed at the motion
13   hearing, none of the named Class members assert their consoles are somehow defective after the PSN
14   was restored, nor do any Class members assert they value their consoles less as a result of the Data
15   Breach. Moreover, with regard to the loss of Third-Party Services, Plaintiffs have not alleged they were
16   unable to access such services through an alternative medium, even if the PSN was a more preferable
17   medium. Therefore, because none of the named Plaintiffs subscribed to premium PSN services, and
18   thus received the PSN services free of cost, Plaintiffs have not alleged “lost money or profits.”19
19   Accordingly, the Court DISMISSES Plaintiffs claims under the UCL, FAL, and CLRA with leave to
20   amend to plead standing.
21                                      3.                     The UCL, FAL, and CLRA Claims Must be Plead with Particularity
22              Even if the named Plaintiffs have standing, Sony argues they have failed to allege the UCL,
23   FAL, and CLRA violations with sufficient particularity. Specifically, Sony contends that because the
24   gravamen of Plaintiffs’ consumer claims is misrepresentation, i.e., that the intrusion and ensuing
25   suspension of service contravened statements originally made by Sony, the heightened pleading
28              See TrafficSchool.com, Inc. v. Edriver, Inc., 653 F.3d 820, 825 n.1 (9th Cir. 2011) (“Plaintiffs
     filing an unfair competition suit must prove a pecuniary injury . . . and “immediate” causation. . .
     neither is required for Article III standing.”).
                                                                                                                                                        24                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222555      ooofff      333666

 1   standards under Rule 9(b) apply.20 Federal Rule of Civil Procedure 9(b) requires that “[i]n all averments
 2   of fraud or mistake, the circumstances constituting fraud or mistake shall be stated with particularity.”
 3   Therefore, “the pleader must state the time, place, and specific content of the false misrepresentations as
 4   well as the identities of the parties to the misrepresentation.” Odom v. Microsoft Corp., 486 F.3d 541,
 5   553 (9th Cir. 2007) (citation omitted). Furthermore, the plaintiff must “set forth an explanation as to
 6   why the statement or omission complained of was false and misleading.” In re GlenFed, Inc. Sec. Litig.,
 7   42 F.3d 1541, 1548 (9th Cir.1994) (en banc), superseded by statute on other grounds.
 8              Plaintiffs do not contest that Rule 9(b) applies to their consumer claims. Instead, Plaintiffs
 9   allege they have satisfied the requirements of the Rule 9(b) because they have sufficiently plead “what is
10   false and misleading about the statement and why the statement is false.” See Cooper v. Picket, 137
11   F.3d 616, 625 (9th Cir. 1997). Sony asserts Plaintiffs have failed to meet this standard because the
12   Consolidated Complaint does not allege (1) actionable statements likely to deceive, and (2) reliance on
13   such statements as required under the statutes.21 Each is discussed in turn.
14                                                             i.                     Actionable Statements that are “Likely to Deceive”
15              The Consolidated Complaint alleges that Sony violated the UCL, FAL, and CLRA by: (1)
16   misrepresenting the quality of its Network security; (2) misrepresenting it would take “reasonable
17   measures” to protect consumers’ Personal Information; (3) misrepresenting that the PS3s and PSPs
18   could access PSN online services; (3) misrepresenting that the PS3s and PSPs would be able to connect
19   to Qriocity, SOE, and other Third Party Services such as Netflix; and (4) failing to disclose that its
20   Network was unsecure. ( Doc. No. 78 ¶¶ 120, 122, 123, 133, 134, 135, 144, 146.). Sony argues that
21   none of these statements are likely to deceive the reasonable consumer.
22              “To state a claim under the [UCL and FAL] one need not plead and prove the elements of a tort.
23   Instead, one need only show that ‘members of the public are likely to be deceived.’ ” Bank of the West,
25             Rule 9(b)’s heightened pleading standards apply equally to claims for violation of the UCL,
     FAL, or CLRA that are grounded in fraud. See Vess v. Ciba–Geigy Corp. USA, 317 F.3d 1097, 1103–06
26   (9th Cir.2003); Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir.2009).
27              The Consolidated Complaint alleges violations under all three prongs of the UCL—the
     unlawful, unfair, and fraudulent prongs. Although Sony does not specifically contest the validity of
28   Plaintiffs’ claims under the unlawful and unfair prongs, to the extent the Court dismisses the underlying
     statutory violations those claims would also fail. See Kowalsky v. Hewlett-Packard Co., 771 F.Supp.2d
     1156, 1162 (N.D. Ca.. 2011) (dismissing UCL claim that was predicated on CLRA violation).
                                                                                                                                                        25                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222666      ooofff      333666

 1   2 Cal.4th at 1267, 10 Cal.Rptr.2d 538, 833 P.2d 545 (quoting Chern v. Bank of America, 15 Cal.3d 866,
 2   876, 127 Cal.Rptr. 110, 544 P.2d 1310 (1976)). “Likely to deceive implies more than a mere possibility
 3   that the advertisement might conceivably be misunderstood by some few consumers viewing it in an
 4   unreasonable manner. Rather the phrase indicates that the ad is such that it is probable that a significant
 5   portion of the general consuming public or of targeted consumers, acting reasonably in the circum-
 6   stances, could be mislead.” Lavie v. Proctoer & Gamble Co., 105 Cal.App.4th 496, 508 (2003) (internal
 7   citations omitted). Thus, “by explicitly imposing a ‘reasonable care’ standard on advertisers, [the FAL]
 8   implicitly adopts such a standard for consumers as well—unless particularly gullible consumers are
 9   targeted, a reasonable person may expect others to behave reasonably as well.” See Freeman v. Time,
10   Inc., 68 F.3d 285, 289 (9th Cir. 1995). Accordingly, the conduct need only be likely to deceive the
11   reasonable consumer, and not a particular consumer. See Williams v. Gerber Prods. Co., 552 F.3d 934,
12   938 (9th Cir. 2010).
13              Here, Plaintiffs have failed to sufficiently plead statements that would likely deceive the
14   reasonable consumer. First, Sony never represented that the PSPs and PS3s would “always” be able to
15   access the internet and/or connect to other online services. Instead, similar to the service agreement in
16   Janda v. T-Mobile, which informed consumers who purchased the phone that the “monthly service rate
17   excludes taxes and surcharges,” the SNE Terms of Service explicitly disclaimed that “continuous and
18   uninterrupted” access to the PSN was a feature of Plaintiffs consoles. 2009 WL 667206, aff’d 378
19   Fed.App’x 705 (9th Cir. 2010) (dismissing plaintiff’s UCL claim with prejudice because it was
20   undisputed that T-Mobile disclosed the imposition of such fees). Moreover, Plaintiffs do not contest
21   that, albeit for the period of interrupted service at issue, their PSPs and PS3s did and still do have the
22   ability to access the PSN Network. Thus, similar to Freeman, where the Ninth Circuit upheld the
23   dismissal of a challenge to a mailer that suggested the plaintiff had won a million dollar sweepstakes
24   because the mailer explicitly stated multiple times that the plaintiff would only win the prize if he had
25   the winning sweepstakes number, here, the disclaimer clearly informed Plaintiffs that access to the PSN
26   was subject to interruption. 68 F.3d 285 (9th Cir. 1995).22
28              The Ninth Circuit found it was not necessary to evaluate additional evidence regarding
     whether the advertising was deceptive because the advertisement itself made it impossible for the
     plaintiff to prove that a reasonable consumer was likely to be deceived.
                                                                                                                                                        26                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222777      ooofff      333666

 1              Furthermore, Plaintiffs’ claim that Sony misrepresented the quality of its Network Security fails
 2   for similar reasons. Before registering for the PSN all Plaintiffs had to agree to Sony’s Privacy Policy,
 3   which states that “there is no such thing as perfect security . . . we cannot ensure or warrant the security
 4   of any information transmitted to us through the [the PSN] . . .” Thus, in the presence of clear
 5   admonitory language that Sony’s security was not “perfect,” no reasonable consumer could have been
 6   deceived. Cf Schnall v. The Hertz Corp., 78 Cal.App.4th 1144, 1163-64 (2000) (finding that disclaimers
 7   do not give notice to the reasonable consumer when they are incomprehensible and needlessly
 8   complex). Therefore, Plaintiffs have failed to sufficiently allege how Sony’s representations taken as a
 9   whole would be likely to deceive the reasonable consumer. Accordingly, the Court DISMISSES
10   Plaintiff’s UCL, FAL, and CLRA claims with leave to amend.
11                                                             ii.                    Reliance
12              Sony further alleges that even if Plaintiffs properly alleged actionable deceptive statements, their
13   claims under the UCL, FAL, and CLRA fail because they have not shown actual reliance.23 Specifi-
14   cally, Sony alleges that Plaintiffs have failed to show that they purchased or otherwise acquired their
15   consoles and Third Party Services on the basis of Sony’s statements regarding the availability of PSN
16   Services or the veracity of Sony’s Network security. In response, Plaintiffs argue that under In re
17   Tobacco II Cases they are not required to plead actual reliance, and under Massachusetts Mutual Life
18   Insurance Co., reliance is presumed where the misrepresentation or omission is material. 46 Cal. 4th
19   298, 328 (2009); 97 Cal.App.4th 1282 (2002). The Court finds both Tobacco II and Massachusetts
20   Mutual inapposite, and thus failure to plead actual reliance by the named Class members fatal to
21   Plaintiffs’ consumer claims.
22              For fraud-based claims under all three consumer statutes the named Class members must allege
23   actual reliance to have standing.24 In re Tobacco II Cases, 46 Cal.4th 298, 306, 207 P.3d 20 (2009) (A
25           The Court addresses this ground for dismissal in the event Plaintiffs amend their Consolidated
26              24
               The standing requirements for a CLRA claim and a UCL/FAL claim differ in a class action.
27   Under the CLRA, each class member must present actual injury, whereas under the UCL/FAL, even
     after Proposition 64, only the named Class representatives must reliance and causation. See In re
28   Steroid Prod. Cases, 181 Cal.App.4th 145, 155 (2010). See also Stearns v. Ticketmaster Corp., 655
     F.3d 1013, 1022 (9th Cir. 2011) (stating that causation on a classwide basis may be established by
                                                                                                                                                        27                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222888      ooofff      333666

 1   plaintiff “proceeding on a claim of misrepresentation as the basis of his or her UCL action must
 2   demonstrate actual reliance on the allegedly deceptive or misleading statements, in accordance with
 3   well-stated principles regarding the element of reliance in ordinary fraud actions”); Cohen v. DIRECTV,
 4   Inc., 178 Cal.App.4th 966, 973, 101 Cal.Rptr.3d 37 (2009) (same for claims arising under the CLRA).
 5   Actual reliance is presumed, or at least inferred, when the omission is material. Tobacco II, 46 Cal.4th at
 6   327, 93 Cal.Rptr.3d 559, 207 P.3d 20. See also Vasquez v. Super. Ct., 4 Cal.3d 800, 814; accord Mass.
 7   Mut. Life Ins. Co., 97 Cal.App.4th at 1292. However, even after Massachusetts Mutual, an inference of
 8   common reliance arises only when plaintiffs can show that but for defendant’s material misrepresenta-
 9   tion or omission plaintiffs would have proceeded differently. 97 Cal.App.4th at 1293; McAdams v.
10   Monier, Inc., 182 Cal.App.4th 174, 184 (2010); Kwikset Corp. v. Super. Ct., 51 Cal. 4th 310, 327, 246
11   P.3d 877, 888 (2011). Finally, where plaintiffs allege “exposure to a long-term advertising campaign,”
12   they need not identify the particular advertisements that induced them to make their purchases. 46
13   Cal.4th 298.25
14              Here, the Consolidated Complaint alleges that Plaintiffs acquired their consoles before
15   consenting to Sony’s Privacy Policy and Terms of Service Agreement, which Plaintiffs allege contain
16   the alleged misrepresentations. Indeed the named Class members contend that they created their PSN
17   accounts—and thus assented to the Terms of Sony’s Terms of Service and Privacy Policy—after they
18   acquired their consoles. Thus, even if the Court found Sony’s alleged misrepresentations material,
19   because Plaintiffs had already purchased or otherwise acquired their consoles when the alleged
20   misrepresentations were made, reliance on such statements in purchasing their consoles is impossible.
21   Therefore, even though Plaintiffs are not required to show that the alleged misrepresentations were the
22   “sole or even decisive” cause of the injury-producing conduct, Plaintiffs are still required to show that
23   the “misrepresentation was an immediate cause” of the injury. Tobacco II, 46 Cal.4th at 328. See also
24   Hall v. Time Inc., 158 Cal.App.4th 847, 857 (2008) (demurrer was properly sustained where the plaintiff
25   did not allege that misrepresentations caused him to pay money for a book or that he would otherwise
26   have returned the book to avoid payment). Accordingly, because Plaintiffs have not plead actual
28              In the class action context, the UCL and FAL only requires named Class members to plead
     actual reliance, whereby the CLRA requires actual reliance of all Class members. See Mass. Mut. Life
     Ins. Co., 97 Cal.App.4th at 1292.
                                                                                                                                                        28                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      222999      ooofff      333666

 1   reliance, cannot rely on an inference of reliance, and have not alleged a long-term advertising campaign
 2   such that reliance is unnecessary, the Court DISMISSES Plaintiff’s claims under the UCL, FAL, and
 3   CLRA with leave to amend to plead actual reliance by the named Class members.
 4                                      4.                     Basis for Restitution and Injunctive Relief under the UCL and FAL
 5              Sony next contends that Plaintiffs’ UCL and FAL claims fail to establish any entitlement to
 6   restitution or injunctive relief, which are the only remedies available to a UCL and FAL claimant. With
 7   regard to restitution, Sony argues Plaintiffs are not entitled to such relief because Plaintiffs paid monies
 8   to third parties—not Sony—any loss of value over the lifetime of the consoles or services did not accrue
 9   to Sony, and Sony offered free premium services for the period of interrupted services. Furthermore,
10   with regard to injunctive relief, Sony argues Plaintiffs have failed to state what injunctive relief, if any,
11   they are entitled to, or how such relief would be warranted as there is no continuing wrong that needs to
12   be rectified. The Court is inclined to agree.
13              Although Plaintiffs seek to justify restitution on the ground that the remedy is permitted to
14   “compel a defendant to return money obtained through an unfair business practice to persons in interest
15   from whom the property was taken,” the remedy requires a corresponding benefit to the defendant. See
16   Trew v. Volvo Cars of N. Amer., No. CIV-S-05-1379, 2006 U.S. Dist. Lexis 4890, at *6 (E.D. Cal. Feb.
17   8, 2006) (finding restitution appropriate even where defendant did not receive money directly from
18   plaintiff if defendant otherwise profited from an unfair business practice). Here, however, Sony did not
19   benefit financially from the Data Breach, nor did Sony receive monies paid by Plaintiffs for Third Party
20   Services. Moreover, because “[c]ase law is clear that the loss of use and loss of value . . . are not
21   recoverable as restitution because they provide no corresponding gain to a defendant,” Plaintiffs cannot
22   use such a basis to support a claim for restitution. Wofford v. Apple, Inc., No. 11-cv-0034-AJB (NLS),
23   2011 WL 5445054 at *3 (S.D. Cal. Nov. 9, 2011). Plaintiff’s did not assert additional grounds for
24   restitution at the motion hearing.
25              With regard to injunctive relief, Plaintiffs allegations are conclusory in that they argue relief
26   should be granted because they have been injured by Sony’s conduct. However, such assertions fail to

                                                                                                                                                        29                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333000      ooofff      333666

 1   specify the relief they seek, or even the basis on which they seek it.26 Accordingly, the Court DIS-
 2   MISSES Plaintiffs’ claims for restitution under the UCL and FAL with prejudice and DISMISSES
 3   Plaintiffs’ claims for injunctive relief under the UCL and FAL with leave to amend.
 4                                      5.                     Applicability of the CLRA
 5              In addition to the deficiencies in Plaintiffs’ CLRA claim noted above, Sony also asserts that
 6   Plaintiffs have (1) failed to comply with the statute’s procedural notice requirements; and (2) failed to
 7   allege an intent to “sell or lease” a “good or service” as required under the statute.
 8                                                             i.                     CLRA Affidavit Requirement
 9              As a prerequisite to seeking damages under the CLRA, a plaintiff is required to provide notice to
10   the defendant of the alleged statutory infraction, and a demand to rectify the alleged violation.27
11   Cal.Civ.Code § 1782(a). Such notice must be received by the defendant thirty (30) days before filing
12   such suit. Cal. Civ.Code § 1782(a). A plaintiff may alternatively file suit for injunctive relief without
13   notice, give notice of intent to amend the claims to add a claim for damages, and amend thirty (30) days
14   after the notice. Cal. Civ.Code § 1782(d).
15              Here, adequate notice was given. The Consolidated Complaint alleges that on June 8, 2011,
16   Plaintiff Johnson mailed Sony notice in writing, and that the notice expressly set forth the nature of the
17   dispute and declared that damages would be sought if the appropriate corrections were not made. After
18   Sony failed to respond, Plaintiffs instituted the current action. Furthermore, in compliance with Cal.
19   Civ. Code § 1780(d), Plaintiff Johnson attached his affidavit to his complaint, which stated that San
20   Diego County is an appropriate venue. See ECF No. 1-1 (Case 3:11-cv-01268-BTM-WMC). Because
21   the CLRA notice requirement is intended to provide the defendant with an opportunity to cure its
22   conduct and avoid an action for damages, the Court finds Johnson’s letter and affidavit satisfy the
23   requirements under § 1780(a) and (d). See Stearns v. Ticketmaster Corp., 655 F.3d 1013, 1023 (9th Cir.
24   2011) (finding CLRA notice does not have to state that Plaintiffs plans to commence a class action); In
26             Plaintiffs acknowledged these deficiencies at the motion hearing, but noted any deficiency
     could be remedied if granted leave to amend.
27              27
                Unlike the UCL and FAL, plaintiffs can recover money damages under the CLRA. Here,
28   Plaintiffs seek compensatory and exemplary damages, an order enjoining Sony from continuing the
     unlawful practices described herein, a declaration that Sony’s conduct violated the CLRA, restitution as
     appropriate, attorneys' fees, and the costs of litigation. [Doc. No. 153.]
                                                                                                                                                        30                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333111      ooofff      333666

 1   re Easysaver Rewards Litig., 737 F.Supp2d 1159, 1178 (S.D. Cal. 2010) (holding that putative class met
 2   the CLRA notice requirements even though plaintiff who had sent the letter and attached the affidavit
 3   was dismissed as a Class representative).
 4                                                             ii.                    Applicability of the CLRA to the Transactions at Issues
 5              California’s Consumers Legal Remedies Act (“CLRA”) establishes a non-exclusive statutory
 6   remedy for unfair methods of competition and unfair or deceptive acts or practices undertaken by any
 7   person in a transaction intended to result or which results in the sale or lease of goods or services to any
 8   consumer. McAdams v. Monier, Inc., 151 Cal.App.4th 674 (2007). Any consumer who suffers any
 9   damage as a result of the use or employment by any person of a method, act, or practice declared to be
10   unlawful by section 1770 of California’s Civil Code, may bring an action against that person to recover
11   actual damages, injunctive relief, restitution of property, punitive damages, and any other relief the court
12   deems proper. See id. (citing Cal. Civ.Code § 1780(a)).
13              In the Consolidated Complaint, Plaintiffs allege Sony violated the CLRA by inducing Plaintiffs
14   and other consumers to purchase PS3s and PSPs, by inducing Plaintiffs and other consumers to purchase
15   or register for the PSN, and by representing that its Network was secure when in fact it knew, or should
16   have known that its Network was vulnerable to attack. [Doc. No. 78 146.] Defendants argue, and the
17   Court agrees, that because Plaintiffs did not “purchase or lease” a “good or service” Plaintiffs’ CLRA
18   claim must fail.
19              First, although the CLRA does not require a contractual relationship between the consumer and
20   the defendant, the transaction must result or be intended to result in the sale or lease of goods or services
21   to a consumer. See McAdams, 151 Cal.App.4th 674 (2007); Wofford v. Apple Inc., 11-CV-0034 AJB
22   NLS, 2011 WL 5445054 (S.D. Cal. Nov. 9, 2011). Here, although Plaintiffs try to fit within the CLRA
23   by arguing that Sony “sold” PSPs and PS3s with the intent that they be used in conjunction with the
24   PSN,” the Court finds this argument unavailing. The PSN is a free service that consumers can choose or
25   refuse to register for. All of which occurs after they purchase a PSP, PS3 or other Sony console. Thus,
26   the purchase of the Sony console is a separate transaction from the transaction to acquire the PSN.
27   Therefore, because consumers who purchased a Sony console, yet never registered for the PSN, or

                                                                                                                                                        31                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333222      ooofff      333666

 1   utilized the device to access Third-Party Services, were not affected by the Data Breach, the Court finds
 2   the transaction at issue does not fall within the parameters of the CLRA.
 3              Even if the Court found the transaction resulted in a sale or lease, Plaintiffs’ CLRA claim would
 4   fail because the PSN is not a good or service as defined under the statute. “Services” within the context
 5   of the CLRA are defined as “work, labor, and services other than a commercial or business use,
 6   including services furnished in connection with the sale or repair of goods.” Cal. Civ. Code §1761(b).
 7   “Goods” are defined as “tangible chattels.” Id. §1761(a). Here, Plaintiffs unavailing argue that the
 8   present action fits within the CLRA because “Sony sold PSPs and PS3s, intending them to be used with
 9   the PSN and other online services.” However, this does nothing to prove that the shutdown of the PSN,
10   which is the basis for Plaintiffs’ claim, is a good or service as defined by the CLRA. Furthermore,
11   California law is clear that software is not a tangible good or service for the purposes of the CLRA. In
12   Ferrington v. McAfee, Inc., 10-CV-01455-LHK, 2010 WL 3910169 (N.D.Cal. Oct.5, 2010), the court
13   discussed the application of the CLRA to a license for the use of software and concluded that the CLRA
14   expressly limits the definition of “goods” to “tangible chattels,” which exclude software from the Acts
15   coverage. See Berry v. American Exp. Publishing, Inc., 147 Cal.App.4th 224, 229, 54 Cal.Rptr.3d 91
16   (Cal.Ct.App.2007). Accordingly, although Plaintiffs tried to differentiate this case from Wofford, this
17   Court sees no difference between an iPhone and the iOS Operating system, and the PSP/PS3 and the
18   PSN. Thus, the Court DISMISSES Plaintiffs’ CLRA claim with leave to amend.
19              C.                      California Civil Code Section 1798.80 “Breach Act” (Fourth Cause of Action)
20              Sony next argues that Plaintiffs have failed to state a claim under the California Database Breach
21   Act, Cal. Civ. Code §§ 1798 et seq. (“the Breach Act”), because: (1) the notice provided was timely as a
22   matter of law; (2) no statutory personal information is alleged; (3) Plaintiffs have failed to allege they
23   were injured as a result; and (4) the claim is barred as to non-resident Plaintiffs.
24              First, Sony claims that its disclosure of the breach was timely as a matter of law because the
25   statute does not require notification immediately upon the very first sign of a potential breach; rather, it
26   requires notice “in the most expedient time possible and without unreasonable delay, consistent with the
27   legitimate needs of law enforcement, . . . or any measures necessary to determine the scope of the breach
28   and restore the reasonable integrity of the data system.” Cal. Civ. Code § 1798.82(a). In support, Sony

                                                                                                                                                        32                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333333      ooofff      333666

 1   points to the California Office of Privacy Protection’s Guidance on best practices following a data
 2   breach, which instructs California businesses that, “Once you have determined that the information was,
 3   or is reasonably believed to have been, acquired by an unauthorized person, notify affected individuals
 4   within 10 business days.” However, because the Court may only take judicial notice of the Privacy
 5   Protection Guidelines as proof of their existence, and not for the truth of the maters asserted therein, the
 6   Court finds that such a factual determination is not proper on a motion to dismiss.
 7              As to Sony’s remaining allegations, because the Court has already found that Plaintiffs have
 8   alleged enough “cognizable injury” to assert standing under Article III, and the parties have not alerted
 9   the Court to any case law defining “injury” under the statute, nor did the Court find any through its own
10   independent research, the Court finds Plaintiffs’ allegations of “injury” sufficient. The same is true
11   regarding whether or not Plaintiffs have sufficiently alleged theft of personal information to fall within
12   the purview of the statute. Finally, although Plaintiffs try once again to save the claims of non-resident
13   Plaintiffs, the Breach Act is clear that it applies only to “ensure the personal information [of] California
14   residents [is] protected.” Cal. Civ. Code § 1798.81.5(a).
15              Finally, although neither party alerted the Court to such in their moving papers, or at oral
16   argument, under Section 1798.84(d), “Unless the violation is willful, intentional, or reckless, a business
17   that is alleged to have not provided all the information required by subdivision (a) of Section 1798.83, to
18   have provided inaccurate information, failed to provide any of the information required by subdivision
19   (a) of Section 1798.83, or failed to provide information in the time period required by subdivision (b) of
20   Section 1798.83, may assert as a complete defense in any action in law or equity that it thereafter
21   provided regarding the information that was alleged to be untimely, all the information, or accurate
22   information, to all customers who were provided incomplete or inaccurate information, respectively,
23   within 90 days of the date the business knew that it had failed to provide the information, timely
24   information, all the information, or the accurate information, respectively.” (emphasis added).28 Thus,
25   because the Consolidated Complaint only alleges that Sony either knew or should have known that its
26   security measures were inadequate, and failed to inform Plaintiffs of the breach in a timely fashion, none
28              28
              Plaintiffs Consolidated Complaint included Section 1798.84 subdivisions (a), (b), (c) and (e),
     but omitted subdivision (d). (Doc. No. 78 at 36-37.)
                                                                                                                                                        33                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333444      ooofff      333666

 1   of Plaintiffs current allegations assert willful, intentional, or reckless conduct on behalf of Sony.
 2   Accordingly, the Court DISMISSES Plaintiffs’ cause of action under the Breach Act with prejudice as
 3   to the non-resident Plaintiffs and with leave to amend as to the California named Plaintiffs.
 4              D.                      Unjust Enrichment (Fifth Cause of Action)
 5              Sony moves to dismiss Plaintiffs’ fifth cause of action alleging there is not an independent cause
 6   of action for unjust enrichment. Courts consistently have held that unjust enrichment is not a proper
 7   cause of action under California law. “The phrase ‘unjust enrichment’ does not describe a theory of
 8   recovery, but an effect: the result of a failure to make restitution under circumstances where it is
 9   equitable to do so.” Melchior v. New Line Prod., Inc., 106 Cal.App.4th 779, 793, 131 Cal.Rptr.2d 347
10   (2003) (quoting Lauriedale Assoc., Ltd. v. Wilson, 7 Cal.App.4th 1439, 1448, 9 Cal.Rptr.2d 774 (1992)).
11   “Unjust enrichment is a general principle, underlying various legal doctrines and remedies, rather than a
12   remedy itself.” Id. (quoting Dinosaur Dev., Inc. v. White, 216 Cal.App.3d 1310, 1315, 265 Cal.Rptr. 525
13   (1989) (quotation marks omitted)). Simply put, “there is no cause of action in California for unjust
14   enrichment.” Id. Accordingly, the Court DISMISSES Plaintiffs’ claim for unjust enrichment with
15   prejudice.
16              E.                      Bailment (Seventh Cause of Action)
17              Finally, Sony seeks dismissal of Plaintiffs’ seventh cause of action because the type of relation-
18   ship and transaction necessary to support a claim for bailment does not exist in this case. The Ninth
19   Circuit, relying on California law, has defined bailment as “the deposit of personal property with
20   another, usually for a particular purpose.” United States v. Alcaraz-Garcia, 79 F.3d 769, 774 n. 11 (9th
21   Cir.1996); see also Whitcombe v. Stevedoring Servs. of Am., 2 F.3d 312, 317 (9th Cir.1993) (stating
22   “California law generally defines a bailment as the delivery of a thing in trust for a purpose upon an
23   implied or express contract”) (internal citation omitted); Earhart v. Callan, 221 F.2d 160, 163 (9th
24   Cir.1955) (defining a bailment as “the relationship arising when personal property is delivered to
25   another for some particular purpose upon an express or implied contract to redeliver the goods when the
26   purpose has been fulfilled or to otherwise deal with the goods according to the bailor's directions”).
27              Plaintiffs’ claim for bailment fails for several reasons. First, as Plaintiffs freely admit, Plaintiffs’
28   Personal Information was stolen as a result of a criminal intrusion of Sony’s Network. Plaintiffs do not

                                                                                                                                                        34                                                                                                                                 11md2258
          !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333555      ooofff      333666

 1   allege that Sony was in any way involved with the Data Breach. Rather, Plaintiffs allege that Sony
 2   failed to maintain adequate security procedures to protect against this type of theft. Thus, there are no
 3   allegations of conversion or any other intentional conduct by Sony that would indicate that Sony sought
 4   to unlawfully retain possession of Plaintiffs’ Personal Information.
 5              Second, the Court is hard pressed to conceive of how Plaintiffs’ Personal Information could be
 6   construed to be personal property so that Plaintiffs somehow “delivered” this property to Sony and then
 7   expected it be returned. If such a legal theory for bailment exists, Plaintiffs have failed to present the
 8   Court with such in its Opposition papers.29 Finally, because the only allegation against Sony regarding
 9   the theft of Plaintiffs’ Personal Information was that Sony was negligent or otherwise engaged in unfair
10   or fraudulent practices, Plaintiffs’ claim for bailment is duplicative of its claims for negligence and
11   violations of California’s consumer protection statutes. Damages under bailment are typically related to
12   the reasonable value of the property that was not returned. See Weisberg v. Loughridge, 253 Cal.App.2d
13   416, 428, 61 Cal.Rptr. 563 (Ct.App.1967) (stating “[o]ne who is in possession of personal property as a
14   bailee and thereafter converts it by excluding therefrom the person rightfully entitled to possession
15   without the consent of the owner is liable for its reasonable value”). Thus, any damages Plaintiffs might
16   be able to recover under this unorthodox claim for bailment would be recoverable under its negligence
17   and/or consumer protection claim. For the reasons stated above, the Court DISMISSES Plaintiffs’
18   claim for bailment with prejudice.
19                                                                                                                                 CONCLUSION
20              For the reasons set forth above, the Court GRANTS in part and DENIES in part Defendants’
21   motion to dismiss. Plaintiffs have until November 9, 2012 to file an amended Consolidated Complaint.
22   Specifically, the Court makes the following findings with respect to Defendants’ instant motion:
23              1.                      GRANTS Defendants’ supplemental request for judicial notice as to all documents, but
24                                      not as to the contents of the Privacy Protection Guidelines;
26              29
               The Court finds the present case distinguishable from cases cited by Plaintiffs. See Software
27   Design & Application, Ltd v. Hoefer & Arnett, Inc., 49 Cal.App.4th 472, 485 (1996) (finding funds in a
     brokerage account are in the nature of bailment); Kremen v. Cohen, 337 F.3d 1024, 1035-36 (9th Cir.
28   2003) (finding internet domain name was property subject to bailment). Moreover, Plaintiffs rely on
     People v. Cohen, a 1857 California Supreme Court case. 8 Cal. 42. The Court does not find this case
                                                                                                                                                        35                                                                                                                                 11md2258
         !aaassseee      333:::111111-­-­-cccvvv-­-­-000222111111999-­-­-AAAJJJBBB-­-­-MMMDDDDDD                  DDDooocccuuummmeeennnttt      222999                  FFFiiillleeeddd      111000///111111///111222                  PPPaaagggeee      333666      ooofff      333666

 1             2.                      GRANTS Defendants’ motion to dismiss for lack of Article III standing as to Defendants
 2                                     SOE and SCA with leave to amend;
 3             3.                      DENIES Defendants’ motion to dismiss for lack of Article III standing as to the
 4                                     remaining Sony Defendants;
 5             4.                      GRANTS Defendants’ motion to dismiss as to the Sixth Cause of Action for negligence
 6                                     with leave to amend;
 7             5.                      GRANTS Defendants’ motion to dismiss as to the First, Second, and Third Causes of
 8                                     Action under the UCL, FAL, and CLRA with prejudice as to non-resident Plaintiffs and
 9                                     Plaintiffs claims for restitution, and with leave to amend with respect to the remaining
10                                     claims;
11             6.                      GRANTS Defendants’ motion to dismiss as to the Fourth Cause of Action under the
12                                     Breach Act with prejudice as to non-resident Plaintiffs, and with leave to amend as to
13                                     resident Plaintiffs and all remaining claims;
14             7.                      GRANTS Defendants’ motion to dismiss as to the Fifth Cause of Action alleging unjust
15                                     enrichment with prejudice;
16             8.                      GRANTS Defendants’ motion to dismiss as to the Seventh Cause of Action alleging
17                                     bailment with prejudice.
22   DATED: October 11, 2012
                                                                                                                                                           Hon. Anthony J. Battaglia
24                                                                                                                                                         U.S. District Judge

                                                                                                                                                       36                                                                                                                                 11md2258

To top